Stonefly

Stonefly, also known as Andariel, Silent Chollima, Onyx Sleet, and APT45, is a threat actor group that has been active since at least 2015 and is believed to be linked to the North Korean government. The group has been involved in various attacks, including ransomware campaigns against Healthcare and Public Health (HPH) sector organizations in the US since May 2021. Notably, Stonefly used the Maui ransomware in these attacks to fund their activities. Furthermore, Stonefly intensified its financial attacks on U.S. companies, exploiting vulnerabilities like Log4j and deploying malware families such as DTRack and MagicRat. The group's activities escalated in the middle of last year when it actively exploited the Log4j vulnerability. Despite an indictment from the U.S. Department of Justice, Stonefly continued its financially motivated cyberattacks against U.S. organizations. The group specializes in targeting organizations holding classified or sensitive information, and in several instances, deployed its custom malware Backdoor.Preft (aka Dtrack, Valefor). In August, Stonefly launched assaults on three organizations in the U.S., even though the ransomware was never deployed, the group managed to infiltrate with multiple tools from its kit before being thwarted. Stonefly has previously targeted hospitals and other healthcare providers during the pandemic, drawing the attention of the Department of Justice. It is also known for targeting high-value espionage targets like U.S. Air Force bases, NASA Office of Inspector General, and government organizations in China, South Korea, and Taiwan. In July 2024, a member of Stonefly was indicted by U.S. authorities for his role in extorting hospitals and other institutions. Despite this, Stonefly continues its operations, flaunting the indictment and a $10 million bounty from the U.S. Department of Justice, indicating a sustained attempt to mount extortion attacks against organizations in the U.S.